MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82d08c29cb4e61dbe7455ff966f20e33f16e941341790363c00c3d261d4def11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


KPOTStealer


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 82d08c29cb4e61dbe7455ff966f20e33f16e941341790363c00c3d261d4def11
SHA3-384 hash: c906090cf282b4d94c6b023b1bbbfd5f0db06e45b0f3e1a9ed3c3e9b7434554e83fc5ffb53038279b4cdc995c37204be
SHA1 hash: 4da266bbfb0847f039aaab720aec23659f62b3e5
MD5 hash: 9ed5412682f264152209ba73af8c77fc
humanhash: six-pasta-equal-lima
File name:9ed5412682f264152209ba73af8c77fc.exe
Download: download sample
Signature KPOTStealer
Create hunting rule
File size:498'688 bytes
First seen:2021-08-12 06:36:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ed992e9862dcdd605c4491d0f95bb1d4 (5 x RaccoonStealer, 4 x KPOTStealer, 3 x RedLineStealer)
ssdeep 12288:BWwOlnX3azDsim9VtclW4bAaMF2jEfZgsoH96GCay:B1OBnazzJWeMF2jEfZgsoYGCB
Threatray 70 similar samples on MalwareBazaar
TLSH T144B4C031AB91C034E5F712F849BA937CA92D7EA0576440CF92E52AEE56306F4BC31787
dhash icon 68e8e8e8aa66a499 (33 x RaccoonStealer, 14 x ArkeiStealer, 11 x RedLineStealer)
Reporter abuse_ch
Tags:exe KPOTStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
133
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9ed5412682f264152209ba73af8c77fc.exe
Verdict:
Malicious activity
Analysis date:
2021-08-12 06:41:09 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e275fdc9-b97d-4209-9485-7b93c3d0a0c2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/178479/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.26955.28443.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file
Creating a file in the %temp% directory
Creating a process from a recently created file
Sending a UDP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5fffb4bd-425f-4a16-a930-36e169a796cf
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/831524
Signature
Contains VNC / remote desktop functionality (version string found)
Creates a thread in another existing process (thread injection)
Creates autostart registry keys with suspicious names
Detected unpacking (overwrites its own PE header)
Hooks files or directories query functions (used to hide files and directories)
Hooks processes query functions (used to hide processes)
Hooks registry keys query functions (used to hide registry keys)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Svchost Process
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 463952 Sample: 9nQZcn1Pum.exe Startdate: 12/08/2021 Architecture: WINDOWS Score: 100 48 Multi AV Scanner detection for submitted file 2->48 50 Machine Learning detection for sample 2->50 52 Contains VNC / remote desktop functionality (version string found) 2->52 54 5 other signatures 2->54 8 9nQZcn1Pum.exe 2 4 2->8         started        12 33A2E4F0.exe 2->12         started        14 33A2E4F0.exe 2->14         started        process3 file4 36 C:\ProgramData\...\33A2E4F0.exe, PE32 8->36 dropped 56 Detected unpacking (overwrites its own PE header) 8->56 58 Creates autostart registry keys with suspicious names 8->58 16 33A2E4F0.exe 8->16         started        signatures5 process6 dnsIp7 38 ebanat6977769.com 8.209.79.46, 49709, 80 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC Singapore 16->38 40 Multi AV Scanner detection for dropped file 16->40 42 Detected unpacking (overwrites its own PE header) 16->42 44 Machine Learning detection for dropped file 16->44 46 2 other signatures 16->46 20 svchost.exe 16->20 injected 22 dwm.exe 16->22 injected 24 svchost.exe 16->24 injected 26 10 other processes 16->26 signatures8 process9 process10 28 BackgroundTransferHost.exe 13 20->28         started        30 backgroundTaskHost.exe 121 58 20->30         started        32 backgroundTaskHost.exe 61 56 20->32         started        34 3 other processes 20->34
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/82d08c29cb4e61dbe7455ff966f20e33f16e941341790363c00c3d261d4def11/
Threat name:
Win32.Exploit.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-08-12 06:36:13 UTC
AV detection:
12 of 46 (26.09%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qliiykoljzq5xz2fl74wn4qogpyw5fatif4qgy6abq6smhkn54iq._file
Verdict:
unknown
Similar samples:
048b796fb78b1a11d598189410f4de21f57094d283fbebaec36fc604b1f66197
KPOTStealer
32e30f494b7bb01ab18836029193c2a79fb63795f978eeed31103f368c6d8fba
KPOTStealer
87fce4a9bf5b5a94b0a722c3061fd931a2fadd301880801b64a1e78d79bb67c5
KPOTStealer
95654525c7022015e1177ff2e8eba84837f6808b6568bccd87af3e55a3c1f481
KPOTStealer
a7d4ad5e6eedf5be0ad6f9ffc704827b7c1e9aeb12d440c847031af8d4d1f7b1
KPOTStealer
ac4c2057efb4137e73e07b5f2706abbec548ba6c526d8fe12645e35c29345ad0
KPOTStealer
cceb5da1ebba042d949f4afef5f5e4638826493201564245be0448920dac639c
KPOTStealer
cdf2ed21f6bda94bdebd880cb3e45005de2e714d8f1311f3d38684f103be2f00
KPOTStealer
eb639e9d45ed4d4cf911195b7ef53d61897dd8f826c542ae411854ddec3aea87
KPOTStealer
+ 60 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/210812-lwm9lagyca/
Behaviour
Suspicious use of WriteProcessMemory
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
8fe1877b2cb312eaa3b1fd4b10bcd9c4050a86f55b602704db3a6a453ff0e7a8
MD5 hash:
2ec55de670faf40bbce8624884512519
SHA1 hash:
de87552e3af4bd3f9cd7baa93b652fc21c60b952
Link:
https://www.unpac.me/results/8202240c-f96a-4a96-9cc4-0833c3a2646b/
SH256 hash:
82d08c29cb4e61dbe7455ff966f20e33f16e941341790363c00c3d261d4def11
MD5 hash:
9ed5412682f264152209ba73af8c77fc
SHA1 hash:
4da266bbfb0847f039aaab720aec23659f62b3e5
Link:
https://www.unpac.me/results/8202240c-f96a-4a96-9cc4-0833c3a2646b/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/82d08c29cb4e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/82d08c29cb4e61dbe7455ff966f20e33f16e941341790363c00c3d261d4def11

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

KPOTStealer

Executable exe 82d08c29cb4e61dbe7455ff966f20e33f16e941341790363c00c3d261d4def11

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1525649/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/178479/

Comments